CVE-2026-48591

The record

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as &quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as <a href="http://example.com/?a=x" onerror="alert(1)">click</a>, executing arbitrary JavaScript in the victim's browser. The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx. This issue affects earmark from 1.4.1 onward.

Affected packages

Related vulnerabilities

• CVE-2026-45118 MyBB is free and open source forum software. CWE-83
• CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. CWE-83
• CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. CWE-83
• CVE-2026-49276 Kirby is an open-source content management system. CWE-83
• GHSA-6xcg-6q43-rj2v Duplicate Advisory: Exported session HTML could keep unsafe markdown links CWE-83
• CVE-2026-53841 OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported… CWE-83
• GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL CWE-83
• CVE-2026-53722 Nuxt is an open-source web development framework for Vue.js. CWE-83